Last reviewed: 24 October 2026
Schools hold some of the most sensitive data in any community: children’s names, birth certificates, health notes, photos, assessment records and parents’ phone numbers and ID numbers. The Data Protection Act, 2019 applies to all of it, and the Office of the Data Protection Commissioner (ODPC) has been actively fining organisations that misuse personal data. Here is what heads and proprietors need to know, in plain language. It is general guidance, not legal advice.
On this page
Is your school a “data controller”?
Yes. A school decides why and how learner and parent data is collected, which makes it a data controller under the Act. The registration regulations made under the Act require certain sectors to register with the ODPC whatever their size, and education is among the sectors named. Check the current list and fees on the ODPC website and register through its portal.
The principles, applied to a school
- Collect only what you need. An admission form needs the child’s details, parents’ contacts and relevant health information. It rarely needs a parent’s employer or salary.
- Say why you collect it. Put a short privacy notice on admission forms and the website.
- Keep it accurate and let parents correct it.
- Keep it secure. Use locked cabinets for paper files and passwords plus limited access for digital files.
- Don’t keep it forever. Set retention periods for records of learners who have left.
Children’s data needs extra care
The Act gives special protection to children’s data: processing generally needs the consent of a parent or guardian, and must be in the child’s best interests. In practice:
- Get written consent before posting photos or videos of learners online, and respect parents who say no.
- Never publish full names next to photos, or rank learners publicly by name.
- Share results only with the learner’s own parents or guardians.
Everyday risks in schools
- Class WhatsApp groups where balances or results are posted for everyone.
- Teachers keeping mark sheets on personal phones with no lock.
- Fee lists printed and pinned on notice boards.
- Shared office computers with no passwords.
- Old files dumped or sold as scrap paper.
Working with software vendors
If a vendor hosts your school system, they act as your data processor. You remain responsible. Before signing, ask:
- Where is the data stored, and who can access it?
- How often is it backed up, and has a restore been tested?
- Will you sign a data processing agreement?
- Can we export all our data and have it deleted if we leave?
See our ERP buyer’s checklist for more questions.
If something goes wrong
If a phone with learner records is stolen, or a file is shared wrongly, contain it, record what happened, and check your notification duty. The Act requires breaches posing real risk to be reported to the ODPC within 72 hours, and affected people to be informed where needed.
Practical setup
Anademy by Ananke Digital builds school websites, admission forms and parent portals with consent fields, role-based access and data export included, and can supply a template privacy notice and photo consent form in its printable pack. Request a quote.
Start small: a privacy notice, a photo consent form, passwords on every device and a list of who can see what will cover most of the risk in an ordinary school this term.
Anademy = Ananke + Academy: school systems by Ananke Digital.